CVE-2022-24984

Forms generated by JQueryForm.com before 2022-02-05 if file-upload capability is enabled allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content...

CVE-2022-23390

CVE-2022-23390 affects BBS Forum, where the vulnerability is in the getType function. Reports indicate that versions 5.3 and earlier are susceptible to arbitrary file uploads due to improper checks in the file handling logic. Affected product: BBS Forum (v5.3 and earlier). Impact: potential arbit...

Elite Graphix Elite Cms File Upload Vulnerability

Elite Graphix Elite Cms is a web content management written in Php language by Elite Graphix India. A platform for storing and organizing information and documents, Elite Graphix Elite Cms v1.0 suffers from a file upload vulnerability that stems from the lack of valid validation of uploaded files...

OIC Exponent CMS 代码问题漏洞

OIC Exponent CMS is a free, open source PHP-based modular content management system CMS from OIC, Inc. The system supports direct editing in pages and provides user management, site configuration, content editing, etc. Exponent CMS has a file upload vulnerability that stems from the application's...

WordPress Download Monitor 信息泄露漏洞

WordPress is a blogging platform developed using the PHP language. File Upload is a file upload plugin used in it. WordPress plugin is an application plugin. WordPress Download Monitor plugin version 4.4.6 and previous versions are vulnerable to arbitrary file download. stems from the fact that t...

CVE-2021-46386

File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileActionupload...

MingSoft MCMS 代码问题漏洞

MingSoft MCMS is a complete open source J2ee system from China's MingSoft. A code issue vulnerability exists in MingSoft MCMS, which stems from a file upload vulnerability in MCMS version =5.2.5. An attacker can exploit this vulnerability to execute arbitrary code remotely...

CVE-2021-46113

In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service...

Remote code execution

In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service...

CVE-2021-46113

In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service...

ForestBlog 代码问题漏洞

ForestBlog is an application. A personal blog A security vulnerability exists in ForestBlog that stems from a security issue where file uploads bypass authentication...

Static Code Injection in gibbonedu/core

Description The file export.php accepts a directory in the q parameter. We can upload a txt file in the server with our php exploit on it and pass its location in the q parameter, then the php exploit in the uploaded txt file will be executed Proof of Concept 1. Upload a txt file. Inside the txt...

CVE-2022-23315

MCMS v5.2.4 is affected by an arbitrary file upload vulnerability in the component /ms/template/writeFileContent.do. The root cause, as described across connected sources, is insufficient validation/filtration of uploaded file types, enabling attackers to upload arbitrary files. This impacts conf...

in microweber/microweber

Description Sensitive information as part of the error is getting disclosed during the upload of an unrestricted file. Steps to Reproduce Instance 1 1. Log in to the application https://demo.microweber.org 2. Add a new post and upload an SVG file and you will see an error message getting Popped o...

Saraban 代码问题漏洞

Saraban is a file management system from Softvibe Thailand. It is used to transfer files and notifications to reduce unnecessary duplication.A file upload vulnerability exists in Saraban, which stems from the application's file upload feature that does not properly perform access control and file...

File Upload Vulnerability in the Flash Flood Monitoring and Early Warning Platform of Siltronic Ltd.

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. A file upload vulnerability exists in the flash flood monitoring and early warning platform of Sicron Technology Co. Ltd, which can be exploited by an attacker to gain control of the server...

File Upload Vulnerability in the Flash Flood Monitoring and Early Warning Platform of Siltronic Ltd (CNVD-2022-10322)

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. A file upload vulnerability exists in the flash flood monitoring and early warning platform of Sicron Technology Limited, which can be exploited by attackers to gain control of the server...

CVE-2022-22530

CVE-2022-22530 affects the SAP S/4HANA F0743 Create Single Payment application (versions 100–106). The issue is improper validation of uploaded/downloaded files, enabling a user with basic rights to inject dangerous content or malicious code, potentially modifying critical information and comprom...

October CMS 代码代码注入漏洞

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A file upload vulnerability exists in October CMS, which stems from the "Create, Modify, and Delete Site Pages" privilege of the management system, and can be exploited by an attacker t...

Sourcecodester Vehicle Service Management System文件上传漏洞（CNVD-2022-09798）

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple web application for automotive repair/service stores or businesses. Sourcecodester Vehicle Service Management System suffers from a file upload vulnerability that can be exploited by attackers to upload...